CIPP/E - Practice Exam
What kind of right is privacy in the context
of article 8 of the European Convention
of Human Rights?
the right to privacy is balanced against
a. an absolute right other rights, so it is not absolute.
b. more important than freedom of others
c. not an absolute right
d. freedom to impart ideas onto others
Which treaty established the European
Economic Community?
The Economic Community was estab-
a. treaty of Paris
lished by the treaty of Rome
b. treaty of Rome
c. treaty of Maastricht
d. treaty of Lisbon
Which European institution audits the
European Union?
the court is the external audit agency of
a. European Parliament the EU, and the name gives away that
b. European Council they mainly perform audits.
c. European Central Bank
d. European Court of Auditors
Which of the following is the executive
body of the European Union?
The Commission is the executive body
a. European Court of Auditors that implements policies and decisions,
b. European Parliament and monitors compliance.
c. European Council
d. European Commission
Which of the following are the two impor-
tant European Privacy Laws?
a. the children online privacy protection
GDPR and ePrivacy
act and the protection of personal infor-
mation act
b. the European convention of human
rights and the data retention directive
, CIPP/E - Practice Exam
c. BCRs and standard contractual claus-
es
d. General Data Protection Regulation
and the e-Privacy Directive
Which directive or law is the most likely
document referred to by a DPO for mar-
keting via e-mail
Although the GDPR also applies, the
e-privacy has specific requirements for
a. GDPR
electronic communications
b. European Conv. Human Rights
c. Data Protection Directive
d. e-Privacy Directive
What is the most fitting definition of per-
sonal data?
Identifiable person. ABC refer to criteria
a. data stored in a filing system that determine how personal data should
b. data subject to automated processing be treated but are themselves not part of
c. anything that says something about an a definition of personal data.
identifiable person
d. information manifestly made public
Who determines the purpose and means
of processing?
Only the controller decides what and how
a. controller a data processing is meant for.
b. processor
c. DPA
When are data considered to be anony-
mous?
if it is traceable, it still personal data and
a. when the names and addresses are cannot be treated as anonymous info.
removed Encrypting something does not irre-
b. when data are encrypted versibly remove identifiers
c. when data cannot be traced back to an
individual
Which of the following is considered a
DS?
, CIPP/E - Practice Exam
a. an identifiable person about whom info
Natural person = DS. If a person is
is stored
anonymous, you cannot tell if the info is
c. an anonymous person wishing no data
actually about that person.
is collected about
Which of the following can be considered
a processor?
the flower shop keeps personal data at
b. a flower shop maintaining a list of
the request of a company, that's proces-
home addresses at the request of one of
sor's activity. C is offering only to private
his corporate customers
customers, not controllers; and d is not
c. a cloud service, offering its services to
collecting on behalf of a controller.
private customers
d. a data broker, selling anonymized data
on its own initiative.
When does the GDPR apply to a
US-based company?
When the company targets EU citizens Since the company is targeting EU citi-
or processes personal data in the EU. zens, that's the most accurate scenario.
When the website attracts EU customers Other options are less explicit and you
to buy American flags. need to identify this type of logic.
When the company employs EU citizens
When the company's website is visited
by EU citizens
Who dos the GDPR most likely apply to?
a. a German individual, collecting and
storing social media info of his wife, who
C is the right one because the Belgian
he suspects is cheating on him
university is a controller operating from
b. a Greek government agency, publish-
Belgium. Regardless of the country mis-
ing a list of deceased people in a recent
spelled, a controller from the EU is re-
natural disaster
sponsible for whatever it does with per-
c. a researcher of a Belgian university, re-
sonal data wherever, under the GDPR.
searching an indigenous tribe in Papua
New Guinea
d. a Spanish agency keeping a list of all
corporations in the region
What kind of right is privacy in the context
of article 8 of the European Convention
of Human Rights?
the right to privacy is balanced against
a. an absolute right other rights, so it is not absolute.
b. more important than freedom of others
c. not an absolute right
d. freedom to impart ideas onto others
Which treaty established the European
Economic Community?
The Economic Community was estab-
a. treaty of Paris
lished by the treaty of Rome
b. treaty of Rome
c. treaty of Maastricht
d. treaty of Lisbon
Which European institution audits the
European Union?
the court is the external audit agency of
a. European Parliament the EU, and the name gives away that
b. European Council they mainly perform audits.
c. European Central Bank
d. European Court of Auditors
Which of the following is the executive
body of the European Union?
The Commission is the executive body
a. European Court of Auditors that implements policies and decisions,
b. European Parliament and monitors compliance.
c. European Council
d. European Commission
Which of the following are the two impor-
tant European Privacy Laws?
a. the children online privacy protection
GDPR and ePrivacy
act and the protection of personal infor-
mation act
b. the European convention of human
rights and the data retention directive
, CIPP/E - Practice Exam
c. BCRs and standard contractual claus-
es
d. General Data Protection Regulation
and the e-Privacy Directive
Which directive or law is the most likely
document referred to by a DPO for mar-
keting via e-mail
Although the GDPR also applies, the
e-privacy has specific requirements for
a. GDPR
electronic communications
b. European Conv. Human Rights
c. Data Protection Directive
d. e-Privacy Directive
What is the most fitting definition of per-
sonal data?
Identifiable person. ABC refer to criteria
a. data stored in a filing system that determine how personal data should
b. data subject to automated processing be treated but are themselves not part of
c. anything that says something about an a definition of personal data.
identifiable person
d. information manifestly made public
Who determines the purpose and means
of processing?
Only the controller decides what and how
a. controller a data processing is meant for.
b. processor
c. DPA
When are data considered to be anony-
mous?
if it is traceable, it still personal data and
a. when the names and addresses are cannot be treated as anonymous info.
removed Encrypting something does not irre-
b. when data are encrypted versibly remove identifiers
c. when data cannot be traced back to an
individual
Which of the following is considered a
DS?
, CIPP/E - Practice Exam
a. an identifiable person about whom info
Natural person = DS. If a person is
is stored
anonymous, you cannot tell if the info is
c. an anonymous person wishing no data
actually about that person.
is collected about
Which of the following can be considered
a processor?
the flower shop keeps personal data at
b. a flower shop maintaining a list of
the request of a company, that's proces-
home addresses at the request of one of
sor's activity. C is offering only to private
his corporate customers
customers, not controllers; and d is not
c. a cloud service, offering its services to
collecting on behalf of a controller.
private customers
d. a data broker, selling anonymized data
on its own initiative.
When does the GDPR apply to a
US-based company?
When the company targets EU citizens Since the company is targeting EU citi-
or processes personal data in the EU. zens, that's the most accurate scenario.
When the website attracts EU customers Other options are less explicit and you
to buy American flags. need to identify this type of logic.
When the company employs EU citizens
When the company's website is visited
by EU citizens
Who dos the GDPR most likely apply to?
a. a German individual, collecting and
storing social media info of his wife, who
C is the right one because the Belgian
he suspects is cheating on him
university is a controller operating from
b. a Greek government agency, publish-
Belgium. Regardless of the country mis-
ing a list of deceased people in a recent
spelled, a controller from the EU is re-
natural disaster
sponsible for whatever it does with per-
c. a researcher of a Belgian university, re-
sonal data wherever, under the GDPR.
searching an indigenous tribe in Papua
New Guinea
d. a Spanish agency keeping a list of all
corporations in the region
